Skip to Content.
Sympa Menu

grouper-users - Re: [grouper-users] Containerized Grouper and Secrets

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] Containerized Grouper and Secrets

Chronological Thread 
  • From: John Schrader <>
  • To: Jack Stewart <>
  • Cc: "Hyzer, Chris" <>, Christopher Hubing <>, "" <>, csp study grouper <>
  • Subject: Re: [grouper-users] Containerized Grouper and Secrets
  • Date: Sun, 29 Apr 2018 12:09:39 -0400
  • Ironport-phdr: 9a23:zTXsWB3cZAgsA2H0smDT+DRfVm0co7zxezQtwd8ZseMRK/ad9pjvdHbS+e9qxAeQG9mDsLQc06L/iOPJYSQ4+5GPsXQPItRndiQuroEopTEmG9OPEkbhLfTnPGQQFcVGU0J5rTngaRAGUMnxaEfPrXKs8DUcBgvwNRZvJuTyB4Xek9m72/q99pHPbQhEniaxba9vJxiqsAvdsdUbj5F/Iagr0BvJpXVIe+VSxWx2IF+Yggjx6MSt8pN96ipco/0u+dJOXqX8ZKQ4UKdXDC86PGAv5c3krgfMQA2S7XYBSGoWkx5IAw/Y7BHmW5r6ryX3uvZh1CScIMb7Vq4/Vyi84Kh3SR/okCYHOCA/8GHLkcx7kaZXrAu8qxBj34LYZYeYP+d8cKzAZ9MXXWhOXshRWSJPAY2ycpUBAPYaMOlCs4XwvUEDoQeiCQSuAu7k1z9GhmXx3a0/y+kvFQbG3AwmH9kTrXrbsNX1NL0IXu+o0qbI1yjIYvRS1zf66IjIdAotr+yQUrJwa8re01QgGB3fjliLr4zqIimZ2foQvGiG9udtU/+khWAgqwF0uDevx8Esh5HUhoIPzlDI7z55wIMtKdKiTU50e9+lEJxWty2AK4R2RcYiT3lwuCkg0b0GopC6fC8QyJs63RLfcPmHf5CJ4hLlSOaePy14hHR7d7KjmRq+61avxfDhVsWsy1ZFsDZKksPSuXARzBzT79KISv1n8UeuxzmPzRrf6vtaLk8uiKXXM4MhwqUumZoJt0TMBCr2l1vsgK+Nc0Up/PWj5ef/Yrj+uJORNpN4hwP7P6QgmcGwGvg0Pw0BUmSH5eiwybju8lHlTLpRi/A7l7fVvZ7GKckdu6W3GRVa0pw55Ba6Fzqm0MoXnX0ALF9dfRKIlYnpO1XXLPD5Efezn02gkTh1y/3IIrHtGJrNLn/EkLfuebZy9VRQxxY0zdBa/55UC7cBL+zvWkLpqtDVDwM1Pg6xzubpC9hyzZ8SVGeAD6OFLK/erFqF6f4zL+aXYYIYvSjxJvY56/L2iH82g14dfa2n3ZsNb3C4G+xrI0eCYXXwgtcBC30FsRcxQeHxjl2NTCRfaGivUKIh/j07Ep6pDZ/fRoCxh7yMxCi7HodRZmBbElCDD23oe5yZW/cXdi2SONRhnycAVbigUI8hyQquuBHgx7pmKOrU5jMXtYjl1Ndr++3fiws++iJpAMSAgCmxSDRWl2gLDwQq0b92u1A1nlKByrR1nNRFEN1Y57VEXhpsZrDGyOkvKdfyXEr6ddeTQVqrWJ3yIzYxSJQKyN8UakpwAf2kglbO0zf8UOxdrKCCGJFhqvGU5HP2Pcsoji+ejKQ=

This is a great conversation..

For those of us running in AWS cloud, AWS has released "SecretsManager" [1]

SecretsManager opens up some interesting possibilities for both EC2 instances and containers(tasks) running in ECS.

As a POC, I've created an elConfig class (thanks to Chris for the capability) that retrieves values for hibernate properties:            = ${edu.internet2.middleware.grouperClient.config.SecretsManagerElClass.getSecret('/grouper/dev','url')}
hibernate.connection.url                        = "$$$$       = ${edu.internet2.middleware.grouperClient.config.SecretsManagerElClass.getSecret('/grouper/dev','username')}
hibernate.connection.username                   = $$$$       = ${edu.internet2.middleware.grouperClient.config.SecretsManagerElClass.getSecret('/grouper/dev','password')}
hibernate.connection.password                   = $$$$
from SecretsManager.

Read/Decrypt access to the `/grouper/dev` secret is controlled by the role associated with an EC2 instance or ECS task.
Using a role helps with the initial credential bootstrapping and allows for immutability.


On Thu, Apr 26, 2018 at 1:27 PM, Jack Stewart <> wrote:

Thank you all for your wonderful feedback!  I hope the discussion continues.

A few thoughts:

- Although Grouper can run with environment variables, it would take a lot of time to convert, and each major upgrade could possibly be made tricky as a result.  Or am I being too paranoid?

- I don’t quite see consensus on a clear way forward.  All the information presented here has been helpful, though.  I will check what others are doing locally.


Jack Stewart
Solutions Architect, Identity and Access Management
University of Michigan

On Apr 26, 2018, at 12:39 PM, Hyzer, Chris <> wrote:

Fyi grouper config can happen in env vars, also the sources.xml can be migrated to


-----Original Message-----
From: [] On Behalf Of Christopher Hubing
Sent: Wednesday, April 25, 2018 1:00 PM
To: Jack Stewart <>
Cc: ; csp study grouper <>
Subject: Re: [grouper-users] Containerized Grouper and Secrets

For I2, we are storing secret things in an encrypted S3 bucket. The build
host has access to read from it, and then pushes the images to a private
Elastic Container Repo. The containers run in ECS.

Here's an example of our Dockerfile for the UI:

Since the new Grouper container is pushed to Dockerhub (and have tags for
patches), it should make it pretty easy to manange (hopefully).


On Wed, 25 Apr 2018, Jack Stewart wrote:

I would like to start out by saying that the new role-based Grouper containers are great!  It was very easy to build the images.

Now my question is, what are other schools doing with regard to their Grouper configurations?  Are you "burning them into" storing them in the containers themselves, or are you using

Converting an application like Grouper to use secrets would be a LOT of work.  Effectively, you would need to convert all of the settings to environment variables.  How would you deal with
the sources.xml files which, by design, need to be customized?

Many thanks,

Jack Stewart
Solutions Architect, Identity and Access Management
University of Michigan
4251 Plymouth Road
Ann Arbor, Michigan 48105-3640
(734) 764-0853

John Schrader
Identity and Access Management
Office of Information Technologies
University of Notre Dame


Archive powered by MHonArc 2.6.19.

Top of Page